How Nordlys ApS Speak Up is built
- The page makes a receipt code of 80 random bits. PBKDF2 turns the code into two values: the case number and the case key.
- The report is encrypted with the case key. The case key is also wrapped for the organization’s public key, so the case handler can open it.
- The server stores the case number, the wrapped key and ciphertext. It never sees the code, so it cannot find a case from a person or a person from a case.
- Coming back, the code gives the same case number and the same key, and the conversation opens in this browser. Data on the server is deleted after 7 days.